HIPAA Privacy Regulations: Other Requirements Relating to Uses and Disclosures of PHI: Underwriting - § 164.514(g)
As Contained in the HHS HIPAA Privacy Rules
|
HHS Regulations as Amended January 2013 |
Standard: uses and disclosures for underwriting and related purposes. If a health plan receives protected health information for the purpose of underwriting, premium rating, or other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and if such health insurance or health benefits are not placed with the health plan, such health plan may only use or disclose such protected health information for such purpose or as may be required by law, subject to the prohibition at §164.502(a)(5)(i) with respect to genetic information included in the protected health information.
| HHS Description and Commentary From the January 2013 Amendments Other Requirements Relating to Uses and Disclosures of PHI: Underwriting |
Proposed Rule
Section 164.514(g) of the Privacy Rule prohibits a health plan that receives protected health information for underwriting, premium rating, or other activities relating to the creation, renewal, or replacement of a contract for health insurance or health benefits, from using or disclosing such protected health information for any other purpose (except as required by law) if the health insurance or health benefits are not placed with the health plan. The Department proposed conforming amendments to § 164.514(g) to: (1) remove the term “underwriting” to avoid confusion given the new definition of “underwriting purposes,” which encompasses the activities described above; and (2) make clear that a health plan that receives protected health information that is genetic information for the above purposes is not permitted to use or disclose such information for underwriting purposes. The proposed removal of the term “underwriting” from § 164.514(g) was not intended as a substantive change to the scope of the provision.
Overview of Public Comments
One commenter suggested that the Department reconsider the removal of the term “underwriting” from this section as it could be viewed as a substantive change to the scope of the provision, and expressed concern that the modification would prohibit a health plan from using or disclosing genetic information as required by other law.
Final Rule
The final rule modifies § 164.514(g) to refer to the prohibition, now at § 164.502(a)(5). However, as with the definition of “health care operations,” we do not remove the term “underwriting” to avoid unnecessary confusion. We also clarify that a health plan may continue to use or disclose protected health information that is genetic information as required by other law, except to the extent doing so would be inconsistent with the prohibition in GINA and this final rule at § 164.502(a)(5)(i) against using or disclosing genetic information for underwriting purposes.
| HHS Description From the Original Rulemaking Other Requirements Relating to Uses and Disclosures of PHI: Underwriting |
As described under the definition of “health care operations” (§ 164.501), protected health information may be used or disclosed for underwriting and other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits. This final rule includes a requirement, not included in the NPRM, that health plans receiving such information for these purposes may not use or disclose it for any other purpose, except as may be required by law, if the insurance or benefits contract is not placed with the health plan.